# Potential Issues

This document lists likely bug risks found during a static read-through. It is not exhaustive for runtime/environmental failures.

## Critical / High
- `app.py:560` `handle_change3` can use `dreamJob` without assigning it when `get_dream_job` succeeds, raising `UnboundLocalError` before leaderboard insert.
- `gamification/pointLogic.py:11` `get_particular_level` can return an empty list when no default level exists; callers index `[0]` in `get_all_points_func`/`get_all_simple_points_func`, causing `IndexError`.
- `Ars/objects.py:205` `AutomationRiskResult.calculate_result` has a mismatched validator signature (`self, cls`), which can raise `TypeError` during model validation in Pydantic v2.
- `Ars/ai_functions.py:49` `calculate_automation_risk` prompts the model to return only an integer, but `output_schema` is `AutomationRiskInput` (many required fields). This likely fails schema parsing or returns invalid data.
- `Ars/routes.py:18` returns an `HTTPException` instead of raising it, so invalid file types could return a 200 with an exception body instead of a 400.
- `controller/tokenManagement.py:21` initializes `Fernet` with `FERNET_SECRET_KEY` at import time; if env vars are missing/invalid, the app will crash on import.

## Medium
- `app.py:165` filename extension parsing uses `file.filename.split('.')[1]`; filenames without a dot or with multiple dots (e.g., `resume.v1.pdf`) will raise `IndexError` or mis-detect types.
- `app.py:163` `UploadFile` does not guarantee a `.size` attribute; accessing it can raise `AttributeError` depending on Starlette version.
- `app.py:276` multiple `async def` routes call `requests.*` synchronously; this blocks the event loop under load and can lead to timeouts or throughput collapse.
- `controller/imports.py:102` `extract_provider` assumes `netloc` has at least two dot segments (`split('.')[1]`), which raises `IndexError` for short or nonstandard domains.
- `controller/jwtcoding.py:23` catches `jwt.JWTError` from `python-jose`; the exception class is usually `jose.JWTError`, so invalid tokens may raise `AttributeError` or bypass intended handling.
- `app.py:424` `/mailing/list` creates a unique index and inserts blindly without handling `DuplicateKeyError`; duplicate emails will surface as 500s, and the route returns `None` (empty 200) instead of a response body.

## Low
- `controller/utils.py:15` Google search query is string-interpolated into the URL without encoding; queries with spaces or reserved characters may break or be misinterpreted.
- `Ars/controllers.py:24` `create_new_hashed_doc_entry` is called even when a document exists; with a unique index this returns a duplicate-key error that is ignored by the caller.
- `gamification/routes.py:67` repeated function names (`get_points`, `get_level_details_and_information`) are overwritten at the Python level; route decorators keep them, but stack traces/logs become ambiguous.